繁體中文 00.01.A completed dataset may need to remain readable while later commands are prevented from modifying its namespace. Namespace Write Protection provides reversible, until-power-cycle and permanent states, separating hardware support, entry permission and actual protection. This report connects those distinctions to FID 84h and explains their consequences for command processing.Namespace Write ProtectionA mechanism controlling whether a namespace accepts operations restricted by its protection state.namespaceNamespace, a formatted quantity of non-volatile memory accessed by a host through a controller.FIDFeature Identifier: selects the Feature to read or configure. The main ideas 01Object and enforcement boundary01-01The setting belongs to a namespace and is enforced...
read more
NVMe Namespace Write Protection: States, Controls, and Command Behavior
00.01.A completed dataset may need to remain readable while later commands are prevented from modifying its namespace. Namespace Write Protection provides reversible, until-power-cycle and permanent states, separating hardware support, entry permission and actual protection. This report connects those distinctions to FID 84h and explains their consequences for command processing.
- Namespace Write Protection
- A mechanism controlling whether a namespace accepts operations restricted by its protection state.
- namespace
- Namespace, a formatted quantity of non-volatile memory accessed by a host through a controller.
- FID
- Feature Identifier: selects the Feature to read or configure.
The main ideas
Object and enforcement boundary
01-01The setting belongs to a namespace and is enforced by every attached controller. Distinguish the storage object from the command’s controller, then consider operations affecting multiple namespaces.
- controller
- Controller, the entity that implements the NVMe interface, fetches commands, and reports completions.
Track states through events
02-01Each state has specific entry and exit paths. Set Features, controller reset and power cycling are distinct triggers, so read every arrow together with its event.
From capability to successful configuration
03-01NWPC advertises support, WPC permits particular entry requests, and WPS reports current state. Successful protection also commits existing volatile write-cache contents to media.
- NWPC
- Namespace Write Protection Capabilities, a controller bit field advertising supported protection states.
- WPC
- Write Protection Control, the field permitting requests to enter particular protection states.
- WPS
- Write Protection State, the namespace’s current protection-state code.
Use and observe protected storage
04-01Read, Flush and management commands have different rules, including cross-namespace effects. Current WPS, completion status and health warnings answer different questions.
00.02.Assumes operating systems, computer organization and basic SSD concepts. Namespaces 7/8 and controllers A/B are illustrative rather than assumed device configurations.
00.03.Start with the four states, examine support and control bits, complete a configuration example, and apply the result to commands. Related fields are grouped and linked from the main explanations.
Connecting the main ideas
00.04.Follow the dataset in namespace 7: choose a protection and release policy, verify that the transition is available, wait for successful configuration, and explain which operations remain possible. Each field answers a concrete question.
00.05.Keep three distinctions in view: support versus entry permission, non-saveability versus persistence, and namespace protection versus an all-media health warning.
01 Start with the protected object and four states
01.01.Namespace Write Protection lets the host control a namespace’s write-protection state. No Write Protect and Write Protect are mandatory when the capability is supported; Until Power Cycle and Permanent are optional. A newly created namespace starts in No Write Protect, and every controller to which it is attached must enforce its state.
- Host
- The system running the operating system and issuing NVMe commands.
Sources: Base 2.4 §8.1.18
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.18, printed pages 664-666, PDF pages 690-692
02 Follow transitions, release and reset behavior
02.01.Set Features can switch between 0 and 1 and enter supported, permitted state 2 or 3 from either. Attempts to change state 2 or 3 with Set Features fail with Feature Not Changeable. In the normal state machine, a power cycle returns state 2 to 0; a Controller Level Reset without power cycling does not release it.
- Controller Level Reset
- A controller-level reset; whether state 2 is released depends on whether power cycling occurred.
- power cycle
- A power-off/power-on cycle, distinct from controller resets that do not cycle power.
Sources: Base 2.4 §8.1.18; 5.2.30.1.38
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.18; 5.2.30.1.38, printed pages 512-513,664-665, PDF pages 538-539,690-691
03 Separate capability, entry permission and current state
| Observed value | What it answers | What it does not establish |
|---|---|---|
| NWPC=03h | Supports 0/1 and 2, not 3 | Currently permanent |
| WPC=03h | Permits requests to enter 2/3 | All namespaces protected |
| WPS=3 | This namespace is permanent | A support bitmap |
| MDS=1 | Multiple domains; state 2 prohibited | All protection prohibited |
- MDS
- Multi-Domain Subsystem, the Identify Controller bit indicating multiple-domain support.
03.01.NWPC advertises supported states; RPMB WPC permits commands to enter state 2 or 3; FID 84h WPS is the namespace’s actual state. WPUPCC=0 or PWPC=0 blocks the corresponding entry request. MDS=1 prohibits state 2 even when its capability and control bits are set.
- WPUPCC
- Write Protect Until Power Cycle Control, the WPC bit permitting entry into state 2.
- PWPC
- Permanent Write Protect Control, the WPC bit permitting entry into permanent protection.
- RPMB
- Replay Protected Memory Block, an authenticated, replay-protected area; this report uses its WPC control field.
Sources: Base 2.4 §8.1.18; 5.2.30.1.38
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.18; 5.2.30.1.38, printed pages 512-513,664-665, PDF pages 538-539,690-691
04 Connect querying, configuration and successful completion
- metadata
- Additional information stored with a logical block; it can contain protection information or serve other purposes.
- CDW
- CDW (Command Dword): a 32-bit command field. In CDW10, 10 is the field index, not a byte offset.
- CQE
- Completion Queue Entry, one completion-result structure in a CQ.
04.01.Select an active namespace with NSID. Get FID 84h with SEL=0 reads current WPS; Set places the requested WPS in CDW11 bits 2:0. SV=1 is not available. SEL=1 has no default to return and fails with Invalid Field in Command. A successful transition to a protected state commits all associated volatile write-cache data and metadata to non-volatile media.
- active
- A namespace attached to the controller processing the command.
- NSID
- Namespace Identifier, a controller-visible numeric handle for a namespace; the identifier is not the namespace object itself.
- SEL
- Select, the Get Features field choosing current, default, saved or capability information.
- SV
- Save, the Set Features bit requesting that an attribute value be saved.
Sources: Base 2.4 §5.2.30.1.38
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.30.1.38, printed pages 512-513, PDF pages 538-539
05 What commands may do after protection
| Command or case | Protection-related handling | Reason |
|---|---|---|
| Read/Compare/Verify | Processed normally; other errors remain possible | Protection does not block these operations |
| Dataset Management modifying protected media | Must fail | Listed commands still obey footnote 1 |
| Flush for a protected NSID | Success, no effect | Cache committed on entry |
| Format names 8 but also modifies protected 7 | Namespace is Write Protected | Actual scope includes a protected namespace |
| Sanitize would modify a protected namespace | Namespace is Write Protected | Absence of an NSID does not bypass protection |
05.01.Figure 737 lists commands normally processed for a protected NSID, with footnotes restricting actions that modify non-volatile media. Flush succeeds with no effect; Directive Receive allocating Streams resources fails with Namespace is Write Protected. Unlisted commands are rejected when the section’s protected-target or cross-namespace modification conditions apply.
Sources: Base 2.4 §8.1.18.2
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.18.2, printed pages 665-666, PDF pages 691-692
06 Interpret results using the right state and status
| Question | Where to look | Example interpretation |
|---|---|---|
| What protects namespace7 now? | WPS from Get FID84h, SEL0 | 1 means Write Protect |
| Is permanent protection supported? | Identify NWPC bit2 | 1 advertises support, not activation |
| Why did a state-change request fail? | Completion plus current state/controls | WPS2 to 0: Feature Not Changeable |
| Is an all-media read-only warning reported? | SMART AMRO | A WPS change alone must not assert it |
- AMRO
- All Media Read-Only, the SMART health-warning bit for an all-media read-only condition.
06.01.Use Get FID 84h to determine namespace write-protection state. The controller must not assert SMART All Media Read-Only solely because this state machine creates a read-only condition; AMRO=0 does not prove that a namespace is unprotected. Combined behavior with external write-protection systems is outside this specification’s definition.
Sources: Base 2.4 §8.1.18.1
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.18.1, printed pages 665, PDF pages 691
A forward route through the specification
R-1Explain the mechanism with the overview and examples, then follow these Base PDF viewer pages in order. On shared pages, start at the specified heading and stop before the next named heading. The Chinese tutorial explains necessary background without repeated reference detours.
| Page order | Start section | Focus and stop heading |
|---|---|---|
| R1 · Base PDF 538–539 | §5.2.30.1.38 | Start at Namespace Write Protection Config. Use Figure541 for WPS, then cover non-saveability, the absent default, rejected transitions and the cache-commit requirement on the next page. Stop before §5.2.30.1.39. |
| R2 · Base PDF 690–692 | §8.1.18 | Start at Namespace Write Protection. Compare states in Figure735, follow event-labeled transitions in Figure736, connect capability and shared enforcement in Theory of Operation, and read Figure737 with all three footnotes on the next page. Stop before §8.1.19. |
| R3 · Base PDF 718 | §8.1.24 · Figure756 byte2 | Finish with only WPC byte2 in the Device Configuration Block: PWPC, WPUPCC and their reset-to-zero behavior. Stop before the RPMB message-type table. Stop before Figure757. |
- Device Configuration Block
- The RPMB target 0 configuration structure containing WPC at byte 2.
Check your understanding
1. After a controller reset without power cycling, can Set WPS=0 release WPS=2?
08.01.No. That reset retains state 2, which Set cannot change. A power cycle follows the special return arrow to 0. Clearing WPUPCC closes future entry permission; it does not release existing protection.
Sources
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.18; 5.2.30.1.38, printed pages 512-513,664-665, PDF pages 538-539,690-691
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.24, printed pages 691-692, PDF pages 717-718
2. Do NWPC=07h and PWPC=1 mean every namespace can now enter Permanent Write Protect?
08.02.The current state still matters. States 0 and 1 have a Set path to 3; changing state 2 to 3 is rejected. Support and entry permission do not replace the state machine.
Sources
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.18; 5.2.30.1.38, printed pages 512-513,664-665, PDF pages 538-539,690-691
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.18; 5.2.30.1.38, printed pages 512-513,664-665, PDF pages 538-539,690-691
3. If a successful capability query returns DW0=6, is WPS=6 and can permanent protection be released?
08.03.Neither follows. With SEL=3, 6 means CHANG=1, NSSPEC=1 and SVBL=0. CHANG describes the existence of changeable values, not permission to change the current value. Query WPS separately with SEL=0.
Sources
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.12; 5.2.12.2; 5.2.30.1.38, printed pages 209-212,512, PDF pages 235-238,538
4. Why does Flush succeed without writing data after protection?
08.04.The transition already commits all associated volatile write-cache data and metadata. Success here does not imply another write, and the rule cannot be extended to Flush on an unprotected namespace.
Sources
Source: NVME-BASE-2.4, Rev. 2.4, §5.2.30.1.38, printed pages 512-513, PDF pages 538-539
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.18.2, printed pages 665-666, PDF pages 691-692
5. If 7 is protected and 8 is not, does naming 8 guarantee that Format NVM can proceed?
08.05.No. Examine the actual formatting scope. If it would modify 7, protection requires rejection. The effect matters in addition to the named target.
Sources
Source: NVME-BASE-2.4, Rev. 2.4, §8.1.18.2, printed pages 665-666, PDF pages 691-692
Comments